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March 22, 2019 Gregory J. Bautista 

914.872.7839 (direct) 
Gregory. B autista @ wilsonelser. com 


Sent Via Regular Mail 

Attorney General Aaron Frey 
Office of the Attorney General 
6 State House Station 
Augusta, Maine 04333 

Re: Data Security Incident 


Dear Attorney General Frey: 

We represent Tower Legal Solutions (“TLS”) with respect to an incident involving the potential exposure 
of certain personal information described in detail below. 

1. Nature of the possible security breach or unauthorized use or access 

On February 19, 2019, TLS discovered that employees’ personal information may have been obtained by 
an unknown, unauthorized third party as the result of a phishing attack. After identifying unusual activity 
surrounding an employee’s email account, TLS immediately engaged computer forensic experts to 
determine whether information in the accounts was at risk. The investigation determined that an intruder 
gained access to the employee’s account, and could have viewed documents that contained employees’ 
names, addresses and Social Security numbers. 

2. Number of Maine residents potentially affected 

Approximately two (2) Maine residents were affected in this potential incident. TLS sent the potentially 
impacted individuals a letter notifying them of this incident on March 22, 2019. A copy of the notification 
sent to the potentially impacted individuals is included with this letter, which informs these Maine residents 
about the 12 months of credit monitoring and identity theft protection services that is being offered to them. 

3. Steps TLS has taken relating to the potential incident 

Upon learning of this issue, TLS immediately engaged computer forensic experts to determine whether 
information in the account was at risk, and took steps to identify anyone potentially impacted by this 
incident. TLS has also taken steps to prevent a similar event from occurring in the future, including 
reviewing and revising their information security policies, resetting employees’ access credentials to ensure 
their systems are secure and implementing multi-factor authentication to their email environment for 
internal staff. 
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4. Other notification and contact information 

If you have any additional questions, please contact me at Gregory.Bautista@wilsonelser.com or 
(914) 872-7839. 


Very truly yours, 
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Tower Legal Solutions Letterhead 


«Name 1» 

«Address 1» 

«Address 2» 

<<City»«State»<<Zip» «Date» 

«Country» 


Dear «Name 1»: 

We are writing to inform you of an incident that may have resulted in the disclosure of your name and Social Security 
number. As an employee of Tower Legal Solutions, we take the security of your information very seriously and 
sincerely apologize for any inconvenience this incident may cause. 

On February 19, 2019, we discovered that your personal information, including your name and Social Security 
number may have been obtained by an unknown, unauthorized third party as the result of a phishing attack. After 
identifying unusual activity surrounding an employee’s email account, we immediately engaged computer forensic 
experts to determine whether information in the account was at risk. Our investigation determined that an intruder 
gained access to the employee’s account and could have viewed documents that contained your name, address and 
Social Security number. While we did not identify specific activity around your information, we are sending you this 
letter out of an abundance of caution to provide you with resources you can use to protect yourself. 

Although we are not aware of any misuse of your information, we have arranged with CyberScout, an identity theft 
education and resolution specialist, to provide you with Single Bureau Credit Monitoring and Triple Bureau 
Credit Report 1 services at no cost to you. These services provide you with alerts for 12 months from the date of 
enrollment when changes occur to your Experian credit file. This notification is sent to you the same day that the 
change or update takes place with the bureau. In addition, we are providing you with proactive fraud assistance to 
help with any questions that you might have or in event that you become a victim of fraud. To enroll in these free 
services, please log on to https://www.myidmanager.com and follow the instructions provided. When prompted, 
please provide the following unique code to receive services: <CODE HERE> 

We sincerely regret any inconvenience that this incident may cause you and remain dedicated to protecting your 
personal information. In addition, we have taken steps to prevent a similar event from occurring in the future, 
including reviewing and revising our policies and resetting employees’ access credentials to ensure our systems are 
secure. 

Tower Legal Solutions remains dedicated to protecting your personal information. Should you have any questions 
or concerns, or to obtain additional information about the free services described above, please call the CyberScout 
help line at 1-800-405-6108 and provide the fraud specialist with your unique code. 

Sincerely, 

Leslie Firtell 

Chief Executive Officer 


1 These services require an internet connection and e-mail account and may not be available to minors under the age of 18 years of age. Please 
note that when signing up for monitoring services, you may be asked to verify personal information for your own protection to confirm your 
identity. 
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Additional Important Information 


For residents of Hawaii , Michigan, Missouri North Carolina and Virginia: It is recommended by state law that you remain vigilant for 
incidents of fraud and identity theft by reviewing credit card account statements and monitoring your credit report for unauthorized 
activity. 

For residents of Illinois, Maryland, MissouriNorth Carolina, Oregon, and West Virginia: It is required by state laws to inform you that you 
may obtain a copy of your credit report, free of charge, whether or not you suspect any unauthorized activity on your account. You 
may obtain a free copy of your credit report from each of the three nationwide credit reporting agencies. To order your free credit 
report, please visit www.annualcreditreport.com, or call toll-free at 1-877-322-8228. You can also order your annual free credit report by mailing 
a completed Annual Credit Report Request Form (available at https://www.consumer.ftc.gov/articles/0155-free-credit-reports) to: Annual Credit 
Report Request Service, P.O. Box 105281, Atlanta, GA, 30348-5281. 

For residents of Oregon : 

State laws advise you to report any suspected identity theft to law enforcement, including the Attorney General, and the Fede ral Trade 
Commission. 

For residents of Illinois, Maryland, North Carolina and Rhode Island: 

You can obtain information from the Maryland and North Carolina Offices of the Attorney General and the Federal Trade Commission 
about fraud alerts, security freezes, and steps you can take toward preventing identity theft. 


Maryland Office of the 
Attorney General 

Consumer Protection Division 
200 St. Paul Place 
Baltimore, MD 21202 
1-888-743-0023 
www.oag.state.md.us 


Rhode Island Office of the 
Attorney General 

Consumer Protection 
150 South Main Street 
Providence Rl 02903 
1-401-274-4400 
www.riag.ri.gov 


North Carolina Office of the 
Attorney General 

Consumer Protection Division 
9001 Mail Service Center 
Raleigh, NC 27699-9001 
1-877-566-7226 
www.ncdoi.com 


Federal Trade Commission 

Consumer Response Center 
600 Pennsylvania Ave, NW 
Washington, DC 20580 
1-877-IDTHEFT (438-4338) 
www.ftc.gov/idtheft 


For residents of all states: 


Fraud Alerts: You can place fraud alerts with the three credit bureaus by phone and online with Equifax 
( https://assets.equifax.com/assets/personal/Fraud Alert Request Form.pdf ) or Experian ( https://www.experian.com/fraud/center.html ). A fraud 
alert tells creditors to follow certain procedures, including contacting you, before they open any new accounts or change your existing accounts. For 
that reason, placing a fraud alert can protect you, but also may delay you when you seek to obtain credit. As of September 21, 2018, initial fraud 
alerts last for one year. Victims of identity theft can also get an extended fraud alert for seven years. The phone numbers for all three credit bureaus 
are at the bottom of this page. 

Monitoring: You should always remain vigilant and monitor your accounts for suspicious or unusual activity. 

Security Freeze: You also have the right to place a security freeze on your credit report. A security freeze is intended to prevent credit, loans, and 
services from being approved in your name without your consent. To place a security freeze on your credit report, you need to make a request to 
each consumer reporting agency. You may make that request by certified mail, overnight mail, regular stamped mail, or by following the instructions 
found at the websites listed below. The following information must be included when requesting a security freeze (note that if you are requesting a 
credit report for your spouse or a minor under the age of 16, this information must be provided for him/her as well): (1) full name, with middle initial 
and any suffixes; (2) Social Security number; (3) date of birth; (4) current address and any previous addresses for the past five years; and (5) any 
applicable incident report or complaint with a law enforcement agency or the Registry of Motor Vehicles. The request must also include a copy of a 
government-issued identification card and a copy of a recent utility bill or bank or insurance statement. It is essential that each copy be legible, 
display your name and current mailing address, and the date of issue. As of September 21, 2018, it is free to place, lift, or remove a security freeze. 
You may also place a security freeze for children under the age of 16. You may obtain a free security freeze by contacting any one or more of the 
following national consumer reporting agencies: 

Equifax Security Freeze Experian Security Freeze Transllnion (FVAD) 

P.O. Box 105788 P.O. Box 9554 P.O. Box 2000 

Atlanta, GA 30348 Allen, TX 75013 Chester, PA 19022 

www.freeze.equifax.comwww.experian.com/freezefreeze.transunion.com 
800-525-6285 888-397-3742 800-680-7289 

More information can also be obtained by contacting the Federal Trade Commission listed above. 
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